CoreOS Release Notes

Security Fixes:

• Update curl to 7.50.3 (https://curl.haxx.se/docs/adv_20160914.html)

Bug Fixes:

• Fix Docker-related networking issue (#254)
• Fix race condition in coreos-metadata on Azure (#1582)
• Fix file mode on sssd.service (#1604)

Changes:

• Introduce Vagrant Parallels images

Updates:

• Linux 4.8.6
• Non-Docker Go binaries now built with 1.7.3
• rkt 1.18.0
• Docker 1.12.3
• coreos-metadata 0.6.1

Changes:

• Removed etcd-wrapper
  • The Stable channel has never contained a version which included this wrapper script and service. If an instance was booted from the Beta or Alpha channels and then moved to the Stable channel, it will lose the etcd-wrapper when it updates to this release.

Security Fixes:

• Update nss-usrfiles with glibc 2.23 (CVE-2014-8121 and CVE-2015-5277)
• Update OpenSSL to 1.0.2j (CVE-2016-8610)
  • Note: SSLv2 methods have been disabled, changing the libssl ABI

Bug Fixes:

• Fix password-length requirement and password logins for SSSD-managed accounts in PAM configuration
• Add support for C.UTF-8 locale (#112)
• Correctly set GPT flags on update-engine restart (#1625)

Changes:

• New installations will have dm-verity enabled by default for the /usr mount.
• Enable support for more Mellanox cards (CONFIG_MLX5_CORE_EN and CONFIG_MLX5_CORE_EN_DCB)
• Enable support for more MegaRAID cards (CONFIG_MEGARAID_NEWGEN)
• Enable support for kprobe and bpf (CONFIG_BPF_SYSCALL, CONFIG_KPROBES, CONFIG_OPTPROBES, CONFIG_KPROBES_ON_FTRACE, CONFIG_KRETPROBES, CONFIG_KPROBE_EVENT, and CONFIG_BPF_EVENTS)
• The support scripts and utilities for GCE images have been moved from the OEM partition into a container image, executed by rkt
• The kubelet-wrapper script has been updated, changing a few variable names
  • KUBELET_VERSION has been deprecated in favor of KUBELET_IMAGE_TAG
  • KUBELET_ACI has been deprecated in favor of KUBELET_IMAGE_URL
  • RKT_OPTS has been deprecated in favor of RKT_RUN_ARGS
• The etcd-wrapper script has been updated along with the addition of etcd-member.service
• A flannel-wrapper script has been introduced and flanneld.service updated to use it
• The DigitalOcean images are now provisioned via Ignition instead of coreos-cloudinit
• Docker's containerd has been split out into a separate containerd.service

Updates:

• Linux 4.8.4
• GnuPG 2.1.15
• CA certificate database from nss 3.27.1
• IANA timezone database 2016e
• Ignition 0.11.2
• rkt 1.17.0
• locksmith 0.4.2

Security Fixes:

• Fix privilege escalation vulnerability in Linux kernel - CVE-2016-5195 (Dirty COW)
• Fix denial of service in systemd - CVE-2016-7795

Security Fixes:

• Fix privilege escalation vulnerability in Linux kernel - CVE-2016-5195 (Dirty COW)
• Fix denial of service in systemd - CVE-2016-7795

Security Fixes:

• Fix privilege escalation vulnerability in Linux kernel - CVE-2016-5195 (Dirty COW)
• Fix denial of service in systemd - CVE-2016-7795

Bug Fixes:

• Disabled dm-verity support by default, unblocking Xen-based environments (#1600)

Bug Fixes:

• Fix nspawn mount propagation (#1578)

Changes:

• New installations will have dm-verity enabled by default for the /usr mount.
• When running via QEMU, Ignition will now correctly use the QEMU config provider.

Updates:

• Update Engine 0.4.0

Bug Fixes:

• Fix occasional networking lock-ups with Docker (#254)
• Fix spurious networking failures when spawning Docker containers (#1554) (#1574) (#1585)
• Allow older Docker clients to communicate with the Docker daemon (#1569)

Updates:

• Update Engine 0.3.2
• Docker 1.11.2

Bug Fixes:

• Make GRUB more robust to odd disk configurations (#1238)
• Mount /etc/hosts into flannel container (#1565)
• Fix deadlock triggered by coreos-cloudinit configuring locksmith (#1588)

Bug Fixes:

• Fix intermittent network issues in Docker containers. (#1554)
• Fix last login message in SSH sessions (#1557)
• Fix systemd user session startup (#1498)
• Support overriding the initrd's default DHCP network configuration with ip= kernel command line options (#981)
• EC2: Fix system console for HVM instances (coreos-overlay#2189)

Updates:

• coreos-cloudinit 1.12.0
• flannel 0.6.2
• Ignition 0.11.1
• Most Go applications are now built with 1.7.1

Updates:

• Locksmith 0.4.1

Updates:

• Locksmith 0.4.1

Security Updates:

• curl 7.50.2 (CVE-2016-7141)

Bug Fixes:

• Don't deny logins due to user's shell (#1523)
• Fix off-by-one error in cgpt resize (#1527)
• Disable the systemd-resolved stub resolver (#1545)

Updates:

• Mayday 1.0.0
• Linux 4.7.3
• etcd 2.3.7
• rkt 1.14.0
• Ignition 0.11.0
• coreos-metadata 0.6.0
• git 2.7.3

Bug Fixes:

• Fix Docker stats API for Kubernetes (#1526)
• Fix off-by-one error in cgpt resize (#1527)
• Disable the systemd-resolved stub resolver (#1545)

Updates:

• Docker 1.11.2
• containerd 0.2.2
• runc 0.1.0

Bug Fixes:

• Correct nameserver option parsing in networkd (#1456)
• Fix erroneous warning about install sections in service units (#1512)
• Fix timer execution calculation in systemd (#1516)
• Improve journald's resilience to ENOSPC errors (#1522)
• Build rkt without TEXTREL section (#1525)
• Reintroduce sdnotify-proxy (#1528)

Changes:

• Removed etcd-wrapper
  • The Stable channel has never contained a version which included this wrapper script and service. If an instance was booted from the Beta or Alpha channels and then moved to the Stable channel, it will lose the etcd-wrapper when it updates to this release.

Updates:

• rkt 1.8.0 (removed on ARM64)
  • The Stable channel has never contained a version which included rkt for ARM64. If an ARM64 instance was booted from the Beta or Alpha channels and then moved to the Stable channel, it will lose rkt when it updates to this release.
• Docker 1.10.3

Bug Fixes:

• Properly expand toolbox mount variable (#1540)

Updates:

• Ignition 0.10.1

Bug Fixes:

• Properly report errors from cgpt repair operations
• Fix deadlock in file_remove_privs() on overlayfs
• Build rkt without TEXTREL section (#1525)
• Reintroduce sdnotify-proxy (#1528)
• Fix disk corruption issues in GRUB by doing stricter GPT header validation
  • GRUB will now abort the boot if the gptprio command fails

Changes:

• Use the default Docker cgroup driver instead of the systemd driver
• Add /dev/disk/by-id links for GCE ephemeral disks (#1465)
• Add SSH helper support in SSSD (#1470)
• Enable IMA, DNS resolution for Ceph, POSIX ACLs for Ceph, and EXT4 encryption in the kernel
• Include qemu_fw_cfg LKM in the initramfs
• Expose mount options for toolbox in the TOOLBOX_BIND environment variable

Updates:

• systemd 231
• dracut 044
• Linux 4.7.1
• btrfs-progs 4.4.1
• libusb 1.0.19
• rkt 1.13.0
• Ignition 0.10.0
• Locksmith 0.4.0
• Docker 1.12.1
• containerd 0.2.3
• runc untagged (Docker uses this untagged version of runc)
• fleet 0.11.8
• curl 7.50.1

Bug Fixes:

• Fix timer assertion in systemd (#1308)
• Correct nameserver option parsing in networkd (#1456)
• Fix timer execution calculation in systemd (#1516)
• Improve journald's resilience to ENOSPC errors (#1522)

Security Updates:

• libcurl 7.50.1 for CVE-2016-5419, CVE-2016-5420, CVE-2016-5421, CVE-2016-4802, CVE-2016-3739

Security Updates:

• libcurl 7.50.1 for CVE-2016-5419, CVE-2016-5420, CVE-2016-5421, CVE-2016-4802, CVE-2016-3739

Security:

• It is no longer necessary to be a member of the wheel group in order to be able to run the su command.
  • If this behaviour is desired, copy the /lib/pam.d/su file to /etc/pam.d/su and edit it to add auth required pam_wheel.so use_uid directly under auth sufficient pam_rootok.so.
• Enable ioctl() and getattr() on pipefs permissions

Bug Fixes:

• Add missing line wrap in etcd-wrapper
• Use the MAC address as the DHCP client ID if the machine is diskless (#1432)
• If coreos.autologin is used, don't check password when entering the emergency shell (#1433)
• Decode Azure userdata for cloud-init properly (#1463)
• Fix colors in PS1 prompt (#1464)
• Allow NSS lookups to succeed if SSSD isn't running (#1466)
• Prune shells that are not installed from /etc/shells (#1474)

Changes:

• Add support for the following in the kernel
  • 3ware 7xxx/8xxx series hardware raid
  • National Semiconductor DP8381x series PCI Ethernet
  • via-rhine network support

Updates:

• Linux 4.7
• rkt 1.11.0
• Ignition 0.8.0
• coreos-metadata 0.5.0

Security Updates:

• libpcre 8.38-r1 for CVE-2014-8964, CVE-2014-8964, CVE-2015-5073, CVE-2015-5073, CVE-2015-5073, CVE-2015-8380, CVE-2015-8381, CVE-2015-8383, CVE-2015-8384, CVE-2015-8385, CVE-2015-8386, CVE-2015-8387, CVE-2015-8388, CVE-2015-8389, CVE-2015-8390, CVE-2015-8391, CVE-2015-8392, CVE-2015-8393, CVE-2015-8394, CVE-2015-8395, CVE-2016-1283, CVE-2016-1283

Bug Fixes:

• Properly escape systemd specifiers (#1459)

Bug Fixes:

• Properly escape systemd specifiers (#1459)

Security Updates:

• wget 1.18 (for ARM64) CVE-2016-4971

Bug Fixes:

• When installing, zero the end of the disk to ensure ZFS data is cleared (#1398)
• Fix a few issues related to moving flannel into a rkt container (#1436 #1445 #1439)
• Ensure transient systemd units are started properly (#1430)
• Use a stable DHCP client identifier when PXE booting (#1432)
• Properly escape systemd specifiers (#1459)

Changes:

• Enabled TCM support in the kernel
• Enabled support for JMicron PATA drives in the kernel
• Enabled kerberos support in SSSD and sshd

Additions:

• etcd-wrapper
  • This wrapper script will allow arbitrary versions of etcd to be fetched and run within a rkt container.
• libgpg-error 1.19

Updates:

• Linux 4.6.4
• rkt 1.10.1
• Ignition 0.7.1
• coreutils 8.25

Security Updates:

• wget 1.18 for CVE-2016-4971
• libpcre 8.38-r1 for CVE-2014-8964, CVE-2014-8964, CVE-2015-5073, CVE-2015-5073, CVE-2015-5073, CVE-2015-8380, CVE-2015-8381, CVE-2015-8383, CVE-2015-8384, CVE-2015-8385, CVE-2015-8386, CVE-2015-8387, CVE-2015-8388, CVE-2015-8389, CVE-2015-8390, CVE-2015-8391, CVE-2015-8392, CVE-2015-8393, CVE-2015-8394, CVE-2015-8395, CVE-2016-1283, CVE-2016-1283

Bug Fixes:

• Fix parsing of the user database which caused systemd-sysusers to crash (#1394)
• Fix handling of certain unicode characters in bash (#1411)
• Fix issue when starting transient services (#1430)
• Include work-around for empty SSH host keys (#106)

Changes:

• Removed Kubernetes kubelet
• Set group for /dev/kvm

Updates:

• bash 4.3_p46

Bug Fixes:

• Fix parsing of the user database which caused systemd-sysusers to crash (#1394)
• Fix handling of certain unicode characters in bash (#1411)
• Fix issue when starting transient services (#1430)
• Include work-around for empty SSH host keys (#106)

Changes:

• Removed Kubernetes kubelet
  • The Stable channel has never contained a version which included the kubelet. If an instance was booted from the Beta or Alpha channels and then moved to the Stable channel, it will lose the kubelet when it updates to this release.
• Set group for /dev/kvm

Updates:

• coreos-metadata v0.4.1
• bash 4.3_p46

Bug Fixes:

• Include work-around for empty SSH host keys (#106)
• Include kernel modules and firmware in initramfs (#1263)
• Fix parsing of the user database which caused systemd-sysusers to crash (#1394)
• Fix handling of certain unicode characters in bash (#1411)
• Fix sudoers options for created users on Azure

Changes:

• Kubernetes kubelet has been removed from the image
• flanneld has been moved from early-docker to a rkt container
• Enable TCM_IBLOCK and TCM_USER2 in Linux
• Set group for /dev/kvm

Additions:

• quota 4.02 (including rpc.rquotad) added to the image

Updates:

• Linux 4.6.3
• bash 4.3_p46
• rkt 1.9.1
• docker 1.11.2
• runc 0.1.0
• containerd 0.2.0

Updates:

• Linux 4.5.7 + patches for CVE-2016-4997 and CVE-2016-4998
• OpenSSH 7.2p2 for CVE-2016-3115
• dhcpcd 6.10.1 CVE-2016-1503
• libgcrypt 1.6.5 CVE-2015-7511
• rsync 3.1.1

Updates:

• Linux 4.6.3 CVE-2016-4997 and CVE-2016-4998
• dhcpcd 6.10.1 CVE-2016-1503
• libgcrypt 1.6.5 CVE-2015-7511

Updates:

• Linux 4.6.3 CVE-2016-4997 and CVE-2016-4998
• dhcpcd 6.10.1 CVE-2016-1503
• libgcrypt 1.6.5 CVE-2015-7511

Changes:

• Remove file, portage, python, and a number of other packages that were mistakenly added to the image in 1045.0.0

Bug Fixes:

• Fix errors in Docker related to setting cpu-shares (#1289)
• Fix failure when relabelling layers in Docker (#1301)
• Fix issue causing coreos-metadata to crash (#1306)

Updates:

• rkt 1.8.0
• Ignition 0.7.0
• coreos-metadata 0.4.1
• wa-linux-agent 2.1.3

Changes:

• Remove file, portage, python, and a number of other packages that were mistakenly added to the image in 1045.0.0
• Populate /etc/hosts with an entry for localhost when the file is absent
• Grant more SELinux permissions on chr_files in container context
• Build Docker with support for the journald logging driver

Updates:

• ntp 4.2.8p8
• rkt 1.7.0

Changes:

• Fix using containers interactively with SELinux coreos-overlay#1986
• ARM64: experimental support for updates and Cavium ThunderX

Changes:

• Removed Kubernetes kubelet
  • The Stable channel has never contained a version which included the kubelet. If an instance was booted from the Beta or Alpha channels and then moved to the Stable channel, it will lose the kubelet when it updates to this release.

Fixes:

• Permit execmem in SELinux policy (#1258)
• Fix support scripts for GCE (#1164, #1273)
• Allow setattr on devpts PTYs and grant PipeFS access

Changes:

• Update coreos-install
  • Download images over HTTPS
  • Correct race condition which caused incorrect versions to be downloaded
  • Use new image signing key

Security Fixes:

• Fall back to pam_deny in authentication (Security Brief)
• Remove login shell for operator user
• Stop disabling SHA512 password hashes in PAM
  • This restores the previous pre-PAM behavior of allowing SHA512 password hashes

Changes:

• The image signing key has been updated again, revoking the sub-key that signed 1045.0.0 and 1047.0.0 and adding a new sub-key for this and future releases.
• Add rkt-admin group which has access to /etc/rkt
• GCE images are now provisioned by Ignition instead of coreos-cloudinit

Updates:

• Linux 4.6
• rkt 1.6.0
• Ignition 0.6.0
• coreos-cloudinit 1.11.0
• Google Compute Daemon 1.3.2

Changes:

• Change systemd's default per-unit task limit from 512 back to unlimited, restoring the behavior of previous releases. A custom limit may be specified via TasksMax individual units or DefaultTasksMax in /etc/systemd/system.conf. #1281
• Fix path to stage1-fly.aci in the kubelet-wrapper script. #1282
• Fix PAM library error in rkt's stage1-coreos.aci. #1283

Updates:

• Linux 4.5.3
• rkt 1.5.1
• coreos-cloudinit 1.10.1
• coreos-metadata 0.4.0
• Ignition 0.5.0

Changes:

• Image downloads are now signed with a new sub-key. https://coreos.com/security/image-signing-key/
• Permit execmem in SELinux policy. #1258
• Add sssd and realmd for integrating with centralized account/auth services. Experimental.
• coreos-install now downloads images over HTTPS

Security Updates:

• OpenSSL 1.0.2h for CVE-2016-2105, CVE-2016-2106, CVE-2016-2107, CVE-2016-2109, CVE-2016-2176
• ntpd 4.2.8p7 for CVE-2016-1551, CVE-2016-1549, CVE-2016-2516, CVE-2016-2517, CVE-2016-2518, CVE-2016-2519, CVE-2016-1547, CVE-2016-1548, CVE-2015-7704, CVE-2015-8138, CVE-2016-1550
• git 2.7.3-r1 for CVE-2015-7545, CVE-2016-2315, CVE-2016-2315
• jq 1.5-r2 for CVE-2015-8863

Security Updates:

• OpenSSL 1.0.2h for CVE-2016-2105, CVE-2016-2106, CVE-2016-2107, CVE-2016-2109, CVE-2016-2176
• ntpd 4.2.8p7 for CVE-2016-1551, CVE-2016-1549, CVE-2016-2516, CVE-2016-2517, CVE-2016-2518, CVE-2016-2519, CVE-2016-1547, CVE-2016-1548, CVE-2015-7704, CVE-2015-8138, CVE-2016-1550
• git 2.7.3-r1 for CVE-2015-7545, CVE-2016-2315, CVE-2016-2315
• jq 1.5-r2 for CVE-2015-8863

Security Updates:

• OpenSSL 1.0.2h for CVE-2016-2105, CVE-2016-2106, CVE-2016-2107, CVE-2016-2109, CVE-2016-2176
• ntpd 4.2.8p7 for CVE-2016-1551, CVE-2016-1549, CVE-2016-2516, CVE-2016-2517, CVE-2016-2518, CVE-2016-2519, CVE-2016-1547, CVE-2016-1548, CVE-2015-7704, CVE-2015-8138, CVE-2016-1550
• git 2.7.3-r1 for CVE-2015-7545, CVE-2016-2315, CVE-2016-2315
• jq 1.5-r2 for CVE-2015-8863

Security Updates:

• ntpd 4.2.8p7

Fixes:

• Whitelisted devices with SCSI_IDENT property (#1236)
• Fixed docker cpu share setting (#1246)

Changes:

• PAM enabled for sshd
• Removed the newly-imposed TaskMax limit for Docker

Updates:

• Linux 4.5.2
• systemd v229
• OpenSSH 7.2p2 for CVE-2016-3115
• etcd 2.3.2
• Go binaries now built with 1.5.4

Changes:

• Partially enable PAM, sshd does not use it by default yet, sudo and console access do.
• Enable SELinux option (-Z) for coreutils. #1059
• Include iSCSI and multipath tools #634
• Enabled pids/hugetlb cgroup controllers.
• Enabled pl2302 usb serial driver.
• Fix OS detection when using the kublet-wrapper script.
• Fix intermittent problems while detecting Exoscale and CloudStack metadata services. coreos-overlay#1893

Fixes:

• Fix high-CPU-load issue with systemd-udevd on Hyper-V (#1036)
• Repair GPT headers before attempting to randomize the disk GUID (#1091)
• Fix vxlan networking issues on Azure when under high load (#1156)
• Cease forwarding the journal to the console (#1162)
• Fix binary resolution error in systemd-nspawn (#1196)
• Fix systemd-networkd assertion failure when stopping (#1197)

Changes:

• DSA support has been removed from OpenSSH
• Enabled DHCPv6
• Added prefixes to grub TPM events to indicate their provenance
• tpm_hostpolicy tool generates a TPM policy file based on host characteristics
• Known good TPM PCR values for CoreOS are now shipped alongside the OS

Updates:

• Linux 4.5.0
• etcd 2.3.1
• fleet 0.11.7
• Ignition 0.4.0
• coreos-cloudinit 1.10.0

Fixes:

• fleet 0.11.7 (#1186)
• Fix systemd-networkd assertion failure when stopping (#1197)

Fixes:

• updated grub to rectify a bug in systems with TPM firmware but a disabled TPM. Support for netboot via grub was improved, and the mechanism used to measure system state into the TPM was modified.

Updates:

• rkt 1.2.1
• Docker 1.10.3
• Ignition 0.3.3
  • Fixes boot failures on EC2 when no config is supplied.
• coreos-cloudinit 1.9.3
• util-linux-2.27-1

Changes:

• tpmown utility added - run to enable and take ownership of a system TPM. This may trigger a system reboot if required for the firmware to change the TPM state.

Updates:

• Ignition 0.3.3
  • Fixes boot failures on EC2 when no config is supplied.

Changes:

• Reverted to Docker 1.9.1
  • This release is intended for the Beta channel. If an instance was booted from the Alpha channel and then moved to the Beta channel, it will downgrade Docker when it updates to this release which will potentially cause problems with images on disk.

Changes:

• Removed Kubernetes kubelet
  • The Stable channel has never contained a version which included the kubelet. If an instance was booted from the Beta or Alpha channels and then moved to the Stable channel, it will lose the kubelet when it updates to this release.

Security Updates:

• Git 2.7.3 (CVE-2016-2324, CVE-2016-2315)

Fixes:

• systemd-journald:
  • Journal offlining is now performed asynchronously and ftruncates coalesced, helps fix:
    • https://github.com/coreos/bugs/issues/334
    • https://github.com/coreos/bugs/issues/990
  • Archived/rotated journals are now explicitly made durable when closing, reducing likelihood unclean shutdown corrupting recently rotated journals.
• systemd sd-event: fixed priority queue comparison function, fixes:
  • http://lists.freedesktop.org/archives/systemd-devel/2015-September/034356.html

Updates:

• Linux 4.4.6
• rkt 1.1.0
• sudo 1.8.15
• nspr 4.12
• Ignition 0.3.2

Changes:

• fleet now runs as the fleet user instead of root.

Security Updates:

• Git 2.7.3 (CVE-2016-2324, CVE-2016-2315)

Changes:

• The VMWare OVA image now defines variables that can be used to configure networking, provide a cloud config, and more. The required functionality is provided by cloudinit 1.9.0 and later.
• Enabled ENCLOSURE_SERVICES, SCSI_ENCLOSURE, GCM, and FIB options in the kernel. #1152 #1150 #1096
• Include headers required for building external modules in /lib/modules/$(uname -r)/build. #1082

Updates:

• The Go compiler has been updated to 1.5.3
• Linux 4.4.4

Security Updates:

• OpenSSL 1.0.2g, for CVE-2016-0702, CVE-2016-0703, CVE-2016-0704, CVE-2016-0705, CVE-2016-0797, CVE-2016-0798, CVE-2016-0799, CVE-2016-0800 (DROWN)

Updates:

• rkt 1.0.0

Changes:

• Enabled EC ciphersuites in OpenSSL

Security Updates:

• OpenSSL 1.0.2g, for CVE-2016-0702, CVE-2016-0703, CVE-2016-0704, CVE-2016-0705, CVE-2016-0797, CVE-2016-0798, CVE-2016-0799, CVE-2016-0800 (DROWN)

Fixes:

• Modify systemd's ConditionNeedsUpdate so that it will pass whenever /usr is changed, not only when it is newer. This will properly trigger user and group creation. (#1137)

Updates:

• Linux 4.4.3
  • Enabled CONFIG_DLM
• curl 7.47.1
• wget 1.17.1
• git 2.4.10
• jq 1.5
• Docker 1.10.2
• coreos-cloudinit 1.9.2
• Ignition 0.3.1

Changes:

• Patch Kubelet v1.1.2 with updated go-dockerclient libarary for docker v1.10.x support
• Enabled EC ciphersuites in OpenSSL

Fixes:

• Revert fix for networkd links unlinking (#1140)

Fixes:

• Revert fix for networkd links unlinking (#1140)
• Override Docker's native cgroup driver to use systemd (#1132)
  • This exec option is provided in the DOCKER_CGROUPS environment variable within docker.service. This can be overridden or removed via a systemd unit drop-in.

Changes:

• wa-linux-agent 2.0.16

Fixes:

• Linux 4.3.6 - fixes #1087
• Selinux policy updates to allow systemctl to work in enforcing mode (#1788)
• Backported a systemd-networkd fix to clean up stale link files - fixes #1081

Fixes:

• glibc patched for CVE-2015-1781, CVE-2014-8121, CVE-2015-8776, CVE-2015-8778, CVE-2015-8779 and CVE-2015-7547 coreos-overlay#1180

Fixes:

• glibc patched for CVE-2014-8121, CVE-2015-8776, CVE-2015-8778, CVE-2015-8779 and CVE-2015-7547 coreos-overlay#1178

Changes:

• Added a new script for launching the kublet under rkt, the bundled /usr/bin/kublet is still available but deprecated. New documentation is still in progress.

Updates:

• Docker 1.10.1
• go-tspi master

Fixes:

• glibc patched for CVE-2014-8121, CVE-2015-8776, CVE-2015-8778, CVE-2015-8779, and CVE-2015-7547 coreos-overlay#1172

Additions:

• New image type openstack_mini which is identical to openstack but with a smaller root filesystem to offer a little more flexibility in how the disk image is used.

Fixes:

• Update to polkit 0.113 again, due to a packaging bug it was mistakenly downgraded to 0.112 in CoreOS 942.0.0.
• Fix install location of rkt's stage1 ACIs so the --stage1-from-dir option works correctly rkt #2160

Updates:

• Linux 4.4.1
• coreos-cloudinit 1.9.0
• socat 1.7.3.1

Fixes:

• Add an [Install] section to flanneld's systemd unit. #1102
• Add support for Ignition in coreos-install.

Updates:

• Docker 1.10
• etcd 2.2.5
• rkt 1.0

Fixes:

• Update to OpenSSL 1.0.2f for CVE-2016-0701 and CVE-2015-3197 and updates CVE-2015-4000 (logjam)

Fixes:

• Update to OpenSSL 1.0.2f for CVE-2016-0701 and CVE-2015-3197 and updates CVE-2015-4000 (logjam)

Fixes:

• Update to OpenSSL 1.0.2f for CVE-2016-0701 and CVE-2015-3197 and updates CVE-2015-4000 (logjam)

Changes:

• Disabled LLMNR in systemd-networkd. To re-enable it, you must override the configuration snippet:

  mkdir -p /etc/systemd/resolved.conf.d
  ln -s /dev/null /etc/systemd/resolved.conf.d/10-disable-llmnr.conf
  

• Allow override flannel docker image via an environment variable #1079

Updates:

• rkt 0.16.0

Fixes:

• Update to ntp 4.2.8p6, which addresses a number of bugs and medium/low CVEs since the prior version of 4.2.8p3.

Changes:

• Minimum password length has been increased to eight

Fixes:

• Update to ntp 4.2.8p6, which addresses a number of bugs and medium/low CVEs since the prior version of 4.2.8p3.

Fixes:

• Update to ntp 4.2.8p6, which addresses a number of bugs and medium/low CVEs since the prior version of 4.2.8p3.

Fixes:

• Fix keyring ref leak in kernel CVE-2016-0728

Fixes:

• Fix keyring ref leak in kernel CVE-2016-0728

Changes:

• Enable BINFMT_MISC support in the kernel

Fixes:

• Fix security issue in OpenSSH 6.9p1, applying the small patch recommended in the 7.1p2 release notes. CVE-2016-0777
• Fix keyring ref leak in kernel CVE-2016-0728

Fixes:

• Fix security issue in OpenSSH 7.1p1, applying the small patch recommended in the 7.1p2 release notes. CVE-2016-0777

Fixes:

• Fix security issue in OpenSSH 7.1p1, applying the small patch recommended in the 7.1p2 release notes. CVE-2016-0777

Security Fixes:

• GRUB: Fix for reading username and password (CVE-2015-8370)

Updates:

• rkt 0.15.0
• Linux 4.4
• Ignition 0.2.6
• etcd 2.2.4

Changes:

• Match ETCD_SSL_DIR between host system and flannel container

Updates:

• etcd 2.2.3

Fixes:

• Many fixes for SELinux with Docker #1015 coreos-overlay#1701
• Keep a copy of System.map under lib/modules coreos-overlay#1698

Updates:

• etcd 2.2.3
• Ignition 0.2.5

Fixes:

• Two out of three of the fixes for using SELinux with Docker #1015
• Keep a copy of System.map under lib/modules coreos-overlay#1698

Bug Fixes:

• Increase systemd-journal-remote per-connection memory limits #927
• Stop using invalid name in disk resize script when using CCISS driver #1037

Changes:

• btrfs-progs 4.2.2
• glibc 2.21
• Linux 4.3.3
  • Enabled kernel FSCACHE for CEPH, CIFS, NFS and 9P network filesystems

Security Fixes:

• OpenSSL 1.0.2e (CVE-2015-3193, CVE-2015-3194, CVE-2015-3195, CVE-2015-3196, and CVE-2015-1794)

Bugs Fixed:

• Remove etcd2 service timeout limit (https://github.com/coreos/bugs/issues/936)
• Fixed regression which prevented machinectl login from functioning (https://github.com/coreos/bugs/issues/1002)
• Fixed shutdown behavior so that it cleanly terminates SSH connections (https://github.com/coreos/bugs/issues/1009)
• Fixed issue which caused systemd-nspawn to crash in certain situations (https://github.com/coreos/bugs/issues/1010)
• Included missing bnx2x firmware (https://github.com/coreos/bugs/issues/1016)
• Enable SCSI_AIC79XX in the kernel (https://github.com/coreos/bugs/issues/1026)
• Fixed inability to schedule kubernetes pods (https://github.com/kubernetes/kubernetes/issues/16961)

Changes:

• rkt 0.13.0
• flannel 0.5.5
• Populate /lib/modules/$(uname -r)/build
  • Kernel modules can now be built out-of-tree using the standard command: make -C /lib/modules/$(uname -r)/build M=$PWD

Security Fixes:

• OpenSSL 1.0.2e (CVE-2015-3193, CVE-2015-3194, CVE-2015-3195, CVE-2015-3196, and CVE-2015-1794)

Bug Fixes:

• Fixed regression which prevented machinectl login from functioning (https://github.com/coreos/bugs/issues/1002)
• Fixed shutdown behavior so that it cleanly terminates SSH connections (https://github.com/coreos/bugs/issues/1009)
• Fixed issue which caused systemd-nspawn to crash in certain situations (https://github.com/coreos/bugs/issues/1010)

Bug Fixes:

• tcsd config file permissions corrected #1003

Changes:

• OpenSSH 7.1p1 with ssh-dss keys re-enabled
  • ssh-dss compatibility will be removed March 1, 2016, as per the announcement
• enable CONFIG_SATA_SVW in kernel
• kubelet v1.1.2

Changes:

• Removed Kubernetes kubelet
  • The Stable channel has never contained a version which included the kubelet. If an instance was booted from the Beta or Alpha channels and then moved to the Stable channel, it will lose the kubelet when it updates to this release.
• coreos-metadata 0.3.0

Changes:

• Docker 1.9.1
• Linux 4.3.0
• rkt 0.11.0
• etcd 2.2.2
• coreos-cloudinit 1.8.1
• coreos-metadata 0.3.0
• trousers 0.3.13
• go-tspi 0.1 (tpmd)

Bug Fixes:

• fixed empty string argument to docker when underlying filesystem is btrfs [#997]

Updates:

• ensure correct ordering of disk-uuid.service and systemd-fsck-root.service [coreos/bootengine#78]

Bug Fixes:

• update-ssh-keys now correctly handles ssh keys that lack a trailing newline #676
• enabled USB_HIDRAW and USB_HIDDEV kernel drivers #953, #975
• use correct pid when processing core dumps in namespaces #172
• backported kernel patch to fix bridge fdb causing infinite loops with bond interfaces #980

Changes:

• selinux support in docker
• go programs built with go1.4.3
• failed unit count is no longer maintained by a 1-minute motdgen.timer unit, and instead is queried on login

Kernel Changes:

• dm-cache support
• enabled PPP, DRBD, NBD, AOE kernel drivers.
• compile kernel with CC_STACKPROTECTOR_STRONG instead of CC_STACKPROTECTOR_REGULAR.
• enable xattr support in squashfs, fixing ping as unprivileged user on pxe and iso images.
• enable extra credential and selinux checks (DEBUG_CREDENTIALS).
• enabled RANDOMIZE_BASE.
• disabled HIBERNATE/KEXEC_JUMP.

Program Updates:

• iptables 1.4.21
• kubelet 1.0.7
• locksmith 0.3.4
• Ignition 0.2.4
• coreos-cloudinit 1.8.0
• locksmith 0.3.4

Library updates:

• nspr 4.10.10

Updates:

• Ignition 0.2.3

Fixes:

• Fix support for running ignition on PXE systems. #955
• Roll back to Go 1.4 to fix issues with Docker. #956

Updates:

• locksmith 0.3.4

Bug Fixes:

• Minimize high-order allocations in OverlayFS (https://github.com/coreos/bugs/issues/489)
• Fixed issue causing journald to consume large amounts of CPU (https://github.com/coreos/bugs/issues/322)
• Removed locksmith's dependency on update-engine (https://github.com/coreos/bugs/issues/944)

Bug Fixes:

• Minimize high-order allocations in OverlayFS (https://github.com/coreos/bugs/issues/489)
• Fixed issue causing journald to consume large amounts of CPU (https://github.com/coreos/bugs/issues/322)
• Fixed issue preventing PXE images from booting (https://github.com/coreos/bugs/issues/933)
• Removed locksmith's dependency on update-engine (https://github.com/coreos/bugs/issues/944)

Changes:

• /usr/share/oem/oem-release has been replaced with the coreos.oem.id kernel parameter
  • After updating to this release, coreos-metadata will no longer work on machines provisioned from 835.1.0. coreos.oem.id will need to be set to the value of OEM_ID, found in /usr/share/oem/oem-release. This can be done by adding set oem_id="<OEM_ID>" to /usr/share/oem/grub.cfg.

Program Updates:

• Ignition 0.2.2
• locksmith 0.3.3
• coreos-metadata 0.2.2

Bug Fixes:

• Minimize high-order allocations in OverlayFS (https://github.com/coreos/bugs/issues/489)
• Fixed issue causing journald to consume large amounts of CPU (https://github.com/coreos/bugs/issues/322)
• Fixed issue preventing PXE images from booting (https://github.com/coreos/bugs/issues/933)
• Removed locksmith's dependency on update-engine (https://github.com/coreos/bugs/issues/944)
• Enabled epoll for libmicrohttpd and systemd-journal-remote (https://github.com/coreos/bugs/issues/919)

Changes:

• /usr/share/oem/oem-release has been replaced with the coreos.oem.id kernel parameter
  • After updating to this release, coreos-metadata will no longer work on machines provisioned before this release. coreos.oem.id will need to be set to the value of OEM_ID, found in /usr/share/oem/oem-release. This can be done by adding set oem_id="<OEM_ID>" to /usr/share/oem/grub.cfg.

Program Updates:

• etcd 2.2.1
• coreos-cloudinit 1.7.0
• Ignition 0.2.2
• locksmith 0.3.3
• coreos-metadata 0.2.2
• logrotate 3.9.1
• vim 7.4.769
• pax-utils 1.0.3
• dhcpcd 6.9.0
• ethtool 3.18
• kmod 21
• less 478
• pciutils 3.3.1
• rng-tools 5
• lvm2 2.02.116

Library updates:

• glib 2.44.1
• libassuan 2.2.1
• libgcrypt 1.6.3
• libusb 1.0.19
• nspr 4.10.8
• libpcap 1.7.4
• libcap 2.24
• libcap-ng 0.7.7
• readline 6.3

Changes:

• Ignition v0.2.1

Bug Fixes:

• Fix SELinux temp files in initrd (https://github.com/coreos/bugs/issues/447)
• Ensure coreos.autologin is obeyed even if filesystem root is read-only

Changes:

• btrfs-progs 4.0.1
• curl 7.43
• git 2.4.9
• wget 1.16.3
• polkit 0.113
• Spidermonkey 1.8.5
• libmicrohttpd 0.9.42

Security Fixes:

• Docker 1.8.3 (CVE-2014-8178, CVE-2014-8179)

Changes:

• etcd2 now notifies systemd when it is ready on startup, ensuring dependent services do not make requests before etcd can answer them. etcd #3613
• PCRE support in grep and other tools is now enabled. #906
• early-docker.service now respects $DOCKER_OPTS from the environment like docker.service does. coreos-overlay #1570

Updates:

• rkt 0.9.0

Fixes:

• Root filesystem initialization was broken for some system since 808.0.0. #905 #477

Changes:

• All Go applications are now built with 1.5.1

Updates:

• Linux 4.2.2
• coreos-cloudinit 1.6.2
• coreos-metadata 0.2.1
• ignition 0.2.0
• util-linux 2.26.2

Bug Fixes:

• Revert Docker logging driver back to JSON (https://github.com/coreos/bugs/issues/483)
• Remove timeouts for Ignition when running on EC2
  • EC2 can take at least 66 seconds to offer a DHCP lease

Changes:

• etcd 2.2.0
• kubelet 1.0.6
• coreos-cloudinit 1.6.1
• Add support for XFS to docker.service
• Reset all interfaces on Packet.net during boot (v.s. just enp1s0f0 and enp1s0f1)
• Allow environment file path to be overridden in flanneld.service

Changes:

• Linux 4.2.0
• systemd 225
• SELinux policy updates
  • SELinux support now compatible with OverlayFS
• rkt 0.8.1
• Docker 1.8.2
  • Enable the journald logging driver
• locksmith 0.3.1
• nfs-utils 1.3.2

Bug Fixes:

• Preserve LESSCHARSET when using sudo (https://github.com/coreos/baselayout/pull/33)
• Include the "rkt" group (https://github.com/coreos/baselayout/pull/34)

Changes:

• Linux 4.1.7

Bug Fixes:

• Correct systemd's handling of machine state on daemon-reload (https://github.com/coreos/bugs/issues/454)
• Fix docker0 bridge failures (https://github.com/coreos/bugs/issues/471)

Additions:

• Support for Interoute

Updates:

• Docker 1.8.1
• coreos-cloudinit 1.6.0
  • Additionally enabled the VMware-Backdoor datasource in VMware images
• Ignition 0.1.6
  • Enables support for Amazon EC2
• OpenSSH 6.9-p1

Bug fixes:

• Fix possible race condition with Ignition by detecting first boot in GRUB instead of in the initrd.

Updates:

• kublet 1.0.4

Updates:

• Linux 4.1.6
• etcd 2.1.2
• coreos-install includes a new image signing GPG key which will be used starting next week.
• Ignition has been removed from the 766 release branch, for now it is only available in alpha releases.

Updates:

• Ignition 0.1.5, fixes intermittent boot failures of new instances on EC2. Only AMIs for 779.0.0 and 788.0.0 were affected.

Bug fixes:

• Ensure SELinux configuration under /etc is initialized correctly. Fixes issues caused by SELinux being enabled but uninitialized in systems that upgraded to 779.0.0. #447
• Remove the selinuxenabled command to work around issue with Ansible. #449
• Fix loading of some firmware files. #450
• Fix potential crash with UDP multicast.

Updates:

• Linux 4.1.6
• etcd 2.1.2
• flannel 0.5.3
• fleet 0.11.5
• ignition 0.1.4 and coreos-metadata 0.1.0
• lsof 4.88

Changes:

• wa-linux-agent 2.0.14
• Support for SELinux is now included. A simple SELinux policy for container isolation is included, and rkt will default to running each container in an independent SELinux context. This policy is currently being run in permissive mode, and any violations will log a warning rather than being blocked. You can enable policy enforcement by editing /etc/selinux/config and changing "SELINUX=permissive" to "SELINUX=enforcing" and rebooting, or change enforcement state temporarily by running "setenforce 1".

Changes:

• coreos-cloudinit 1.5.1

Fixes:

• Correct expansion of KUBELET_OPTS in kubelet.service

Changes:

• fleet 0.11.4

Fixes:

• Update Rackspace OnMetal images to avoid network races (https://github.com/coreos/bugs/issues/427)

Changes:

• Ignition 0.1.3
• Linux 4.1.5
• Make Azure product_uuid readable to all users
• coreos-cloudinit 1.5.1
• Support user-defined logrotate configs in /etc/logrotate.d

Additions:

• kubelet 1.0.1
• socat 1.7.3

Fixes:

• Fix issue which prevented Docker from running after rkt has run (https://github.com/coreos/bugs/issues/420)

Changes:

• Linux 4.1.4
• Re-add [Install] section to etcd2 and fleet service units
• The audit subsystem has been enabled in the kernel and auditctl added to the image. Most audit events are ignored by default. The audit rules may be modified in /etc/audit/rules.d. Note that auditd is not included, journald is responsible for logging events instead although it is a best effort mechanism. Unlike with auditd based systems the kernel will not panic if journald fails to record an event for some reason.

Additions:

• bind-tools 9.10.2_p2 (includes dig, nslookup, host)
• whois 5.1.5 (includes whois, mkpasswd)
• strace 4.9

Security Fixes:

• e2fsprogs 1.42.13 (CVE-2015-1572)

Fixes:

• Enable the rkt metadata service (https://github.com/coreos/bugs/issues/419)

Changes:

• flannel 0.5.2

Fixes:

• Fixed grace period on rkt garbage collection timer unit (https://github.com/coreos/coreos-overlay/issues/1377)
• Fixed Docker restart failure (https://github.com/coreos/init/issues/169)
• Revert the osType back to "other26xLinux64Guest" in VMware images

Changes:

• etcd 2.1.1
• Linux 4.0.9
  • Disable audit logging in the kernel
• rkt 0.7.0

Additions:

• /usr/share/oem/oem-release
• Ignition 0.1.2

Fixes:

• Fix kernel compilation issue that caused Go 1.3.x Go 1.3.x to segfault when calling functions in the vDSO library. Issue only effected alpha 738.1.0.
• Do not completely ignore the router provided via DHCP if more than one is listed. For now only the first one is used.
• Fix journal-gatewayd which has been broken since systemd 220.

Changes:

• flannel 0.5.1
• Docker 1.7.1
• coreos-cloudinit 1.5.0
• vim 7.4.712

Additions:

• New packet OEM images.

Security Fixes:

• OpenSSL 1.0.1p (CVE-2015-1793)

Security Fixes:

• OpenSSL 1.0.1p (CVE-2015-1793)

Security Fixes:

• OpenSSL 1.0.1p (CVE-2015-1793)

Updates:

• systemd 222
• sqlite 3.8.10.2
• libxml2 2.9.2

Additions/Changes:

• Add logrotate 3.8.9 for properly rotating /var/log/btmp and /var/log/wtmp
• Enable audit and SELinux subsystems in the kernel, requires passing selinux=1 to the kernel to enable but this is of limited use, no SELinux user space tools or policies are included yet.
• Enable driver for Solarflare NICs.
• Add Secure Boot lockdown patch set to the kernel. Not yet supported by our boot process though.
• Enable NAT-based networking in systemd-nspawn. This doesn't yet work out of the box, networkd configuration files need to be updated so docker's configuration doesn't conflict with nspawn's.
• Fix a networkd bug that impacted some bond interfaces.
• Enable ixgbevf network devices for Amazon EC2 HVM instances that support it. Amazon brands this as Enhanced Networking. As part of this change we disabled the Predictable Network Interface Names scheme on EC2 to ensure network interfaces remain named eth0, eth1, etc. regardless of whether the ixgbevf or Xen driver is in use. This may impact users who enabled this feature themselves on previous versions which would have named the device ens3 instead of eth0.

Updates:

• Linux 4.0.7
• etcd 2.0.13
• flannel 0.5.0
• gnupg 2.0.26
• elfutils 0.161
• libassuan 2.1.1
• libksba 1.3.3
• protobuf 2.5.0
• btrfs-progs 3.17.3
• lsof 4.87

• Revert to Docker 1.6.2
  • Docker 1.7.0 introduced a regression that prevents flannel from running

• Docker 1.7.0
• lshw 2.16b
• gnutls 3.3.15

• Reverted etcd to 2.0.10

• Fix booting CoreOS on Vagrant (https://github.com/coreos/bugs/issues/382)
• OpenSSL 1.0.1o
• Fix mounting /sysroot on bare metal
• Update CA certificates to NSS 3.19.1
• Add jq 1.4
• fleet 0.10.2
• etcd 2.0.12
• Updated a number of system libs and utilities
  • pciutils 3.2.0
  • pth 2.0.7
  • less 458
  • mdadm 3.3.1
  • parted 3.2
  • gzip 1.6
  • libpcap 1.6.2
  • libevent 2.0.22
  • libmicrohttpd 0.9.39
  • dbus-glib 0.102
  • libpcre 8.36
  • popt 1.16
  • readline 6.2_p5

• fleet 0.10.2

• OpenSSL 1.0.1o
• Linux 4.0.5
• Addresses potential disk-corruption issues
• Fixes occasional kernel panics

• OpenSSL 1.0.1o
• Reverted etcd to 2.0.10
• Linux 4.0.5
• Addresses potential disk-corruption issues
• Fixes occasional kernel panics

• Linux 4.0.5
• systemd 220
• rkt 0.5.5
• Added a garbage collection service (rkt-gc.service) on a periodic timer
• Include rng-tools (not enabled by default)
• wa-linux-agent 2.0.13

• etcd 2.0.11
• Correct the default timezone to UTC
• bash 4.2 p53
• dbus 1.8.16
• git 2.3.6
• patch 2.7.3
• sed 4.2.1
• rsync 3.1.1
• zip 3.0
• unzip 6.0
• which 2.20
• file 5.22
• curl 7.42.1

• Linux 4.0.1
• Enable SCSI_MVSAS

• Docker 1.6.2
• Linux 4.0.3
• coreos-cloudinit 1.4.1
• Use systemd-timesyncd instead of ntpd for time synchronization
• By default, systemd-timesyncd will prefer time servers provided by DHCP and fall back to coreos.pool.ntp.org
• Mount root volume read/write via kernel cmdline instead of in the initramfs
• Blacklist xen_fbfront on ec2 images
• Fixes 30s pause during boot (https://github.com/coreos/bugs/issues/208)
• Enable 3w_sas and 3w_9xxx kernel modules
• openssl 1.0.1m
• dhcpcd 6.6.7
• Updated timezone data to 2015b

• Revert to Docker 1.5.0

• Docker 1.6.1-rc2
• [CVE-2015-3629] Symlink traversal on container respawn allows local privilege escalation
• [CVE-2015-3627] Insecure opening of file-descriptor 1 leading to privilege escalation
• [CVE-2015-3630] Read/write proc paths allow host modification & information disclosure
• [CVE-2015-3631] Volume mounts allow LSM profile escalation
• Enable dell RBU and DCDBAS kernel modules
• SDK: upgrade portage to 2.2.18

• Docker 1.6.0
• Fix ETCD_ELECTION_TIMEOUT option for OEMs
• Machines will need to be reprovisioned to pick up this change.
• Flannel 0.4.0
• Introduce actool 0.5.1
• rkt 0.5.4
• Enable systemd-importd
• Fleet 0.10.1
• Linux 4.0.1
• Enable SCSI_MVSAS LKM
• etcd 2.0.10
• Build Go binaries with golang 1.4.2

• Linux 4.0
• Demote XEN framebuffer to module (https://github.com/coreos/coreos-overlay/pull/1206)
• Fixes 30s pause during boot (https://github.com/coreos/bugs/issues/208)
• util-linux 2.25.2
• dracut 041
• open-vm-tools 9.10.0
• vim 7.4
• Bind /run into toolbox (https://github.com/coreos/toolbox/pull/14)

• etcd 0.4.9, 2.0.8
• coreos-cloudinit 1.4.0
• flannel 0.3.1
• fleet 0.10.0
• locksmith 0.3.0
• curl 7.41

• systemd 219
• Expose Docker socket to GCE agent (https://github.com/coreos/coreos-overlay/pull/1180)

• Linux 3.19.3
• glibc 2.20
• Enable zRAM kernel feature
• fleet 0.9.2
• Mayday 0.1.0
• etcd 0.4.9
• rkt 0.5.3
• coreos-cloudinit 1.3.4

• etcd 0.4.8
• OpenSSL 1.0.1l
• nspawn: Map seccomp filters to capabilities
• networkd: Fix network-wait-online hanging
• systemd: Fix handling of malformed line continuation
• Azure: Add "earlyprintk" kernel parameter

• rkt 0.4.1
• util-linux 2.26.1
• Disable threaded execution for ntp (https://github.com/coreos/bugs/issues/304)
• Add UseNTP DHCP option in network units (https://github.com/coreos/coreos-overlay/pull/1142)
• Allow systemd-timesyncd to run in VMs (https://github.com/coreos/coreos-overlay/pull/1142)
• wa-linux-agent 2.0.12
• Lower LimitNOFILE for flannel (https://github.com/coreos/coreos-overlay/pull/1128)
• openSSH 6.7_p1

• Experimental: Add Rocket 0.3.2. Note: Rocket and the App Container Spec are still under heavy development. Command line flags and on-disk image store change between releases.

• Revert to systemd 218 (https://github.com/coreos/bugs/issues/297)
• Set LimitNOFILE for etcd.service

• systemd 219
• Add volume for SSL certs to flannel
• Prevent networkd from attempting to configure flannel interfaces
• TI-RPC 0.2.5
• Include TI-RPC configs in all images
• Linux 3.19
• Enable RAM-disk LKM

• fleet 0.9.1

• Remove domain name from /etc/issue
• coreos-cloudinit v1.3.3
• iproute2 3.19
• Enable lzma and gcrypt on systemd
• glibc 2.19

• locksmith 0.2.3
• coreos-cloudinit 1.3.2
• Properly load iptables LKM before starting flannel
• Fixed sshd issue on Azure
• Previously attempted in 591
• Experimental support for CloudSigma

• Reverted to coreos-cloudinit 1.2.1

• coreos-cloudinit 1.3.1

• Linux 3.18.6
• Docker 1.5
• Changed mount propagation from "shared" to "slave"
• Fixed sshd issue on Azure
• etcd 0.4.7
• coreutils 8.23
• coreos-cloudinit 1.3.0
• flannel 0.3.0
• Format the root ext4 filesystem with the maximum number of inodes, required for many docker workloads when using the new overlay backend.

• Allow systemd-nspawn to load modules
• Fix DefaultDependancies issue with Docker containers (shutdown.target will now wait on Docker containers)
• Allow DefaultDependancies to be set on transient units
• Fix Docker to set DefaultDependancies on its containers
• Allow user-defined DOCKER_OPTS in addition to running flannel (https://github.com/coreos/bugs/issues/244)
• Enabled kernel support for SMB2
• Linux 3.18.4

• Allow user-defined DOCKER_OPTS in addition to running flannel (https://github.com/coreos/bugs/issues/244)

• Patched glibc to address CVE-2015-0235

• Patched glibc to address CVE-2015-0235
• Accept DHCP provided domain names that end in a dot. Broken since 534.1.0

• Patched glibc to address CVE-2015-0235
• Reverted to SYSLINUX 4.07 for ISO boot loader.

• Drop default --insecure-registry=0.0.0.0/0 flag from docker service. If you access registries without HTTPS you must set --insecure-registry= yourself.
• coreos-cloudinit 1.2.1
• Add ebtables command line tool.
• Fix coreos-install with new ext4 based images.
• Accept DHCP provided domain names that end in a dot. Broken since 534.1.0

• Linux 3.18.2
• Switch to ext4 as the default root filesystem. Existing systems using btrfs are unaffected.

• Linux 3.17.8
• openssl 1.0.1k

• openssl 1.0.1k
• Fix the -b base URL option in coreos-install
• Added support for customizing the login MOTD.
• SDK only: disable ccache to avoid a few different build errors it has been causing.

• Fix early-docker.service, broken since 547.0.0. Required by flannel.

• coreos-cloudinit 1.1.0

• Roll back to Go 1.3.

• Fix symlinks for commands halt poweroff reboot runlevel shutdown telinit (broken in 547.0.0)
• Go updated to 1.4

• Linux 3.18.1
• Docker 1.4.1
• coreos-cloudinit 1.1.0
• btrfs-progs 3.17.1
• Re-enable including DHCP provided domain name in resolv.conf (missing since v534.1.0)
• Fix file permissions on systemd journal. (broken since v534.1.0)

• ntp 4.2.8
• Add --insecure-registry=0.0.0.0/0 to docker by default, previously was only committed to the 494.x.x branch by mistake. See https://coreos.com/blog/docker-1-3-2-stable-channel/ for details.

• systemd 218
• ntp 4.2.8
• flannel 0.2.0
• Include CoreOS version in MOTD
• Fix vmtoolsd in VMware images, ld.so.cache was still being generated incorrectly after the first boot.